General

  • Target

    locker.exe

  • Size

    96KB

  • Sample

    240722-ggp3ms1gln

  • MD5

    f2968d0ef2c95f2a2dfb8740b6a2df3f

  • SHA1

    57db6387ab42a51e185bbbf7d54bdfef2541b59c

  • SHA256

    25e41d0a73121a4314df3ce977d182739f592d168999cfa6cd0b8eb69c0e6ebe

  • SHA512

    df35537fc5792cfae0c268c0b8ba49afb62a0672cd83bfe2ab899b85079423b1aa14d2a25b0c72f3b884315e35bbb7b53543780f212bdb67b105a2953a667d09

  • SSDEEP

    768:kCq6+Ae2btbSbEdAp5pAFBkmT2flfuFbMg:HT+ADtbSbeupmymT2flfu9Mg

Score
10/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Recovery.txt

Ransom Note
Greetings, We regret to inform you that your data has been encrypted by Mesmerised Locker as part of a sophisticated global attack utilizing zero-day exploits. We understand that this situation is stressful and are here to guide you through the recovery process. What Happened: Encryption: Your files have been secured using state-of-the-art encryption algorithms: ChaCha20, AES-256, and RSA-4096. These methods are recognized for their high security and are employed by governments and institutions worldwide. Detailed information on these encryption methods can be found here: - ChaCha20: https://en.wikipedia.org/wiki/Salsa20 - AES-256: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard - RSA-4096: https://en.wikipedia.org/wiki/RSA_(cryptosystem) Data Theft: In addition to encryption, we have exfiltrated sensitive data, including personal messages and confidential information. Our Intentions: Decryption Offer: To demonstrate our capability to restore your data, we are willing to decrypt 2-3 files at no cost. Payment: To obtain the decryption key for your data, we request a payment of $50 or an equivalent item. This fee reflects the scale and complexity of our operation. How to Proceed: 1. Contact Us: To initiate communication, use session ID 050126e07b2964020ad7242a12a63a3476f22a3956877fd8a7f2d3a01bb1140759. Download the Session app from https://getsession.org to contact us securely. 2. Payment: Upon establishing contact, we will provide instructions for making the payment. Once the payment is confirmed, we will supply the decryption key and detailed instructions for data recovery. Consequences of Non-Compliance: Data Exposure: Failure to comply with our demands will result in the dissemination of your sensitive data to your contacts and potentially the public. Data Loss: Attempting to use third-party tools for decryption may result in irreversible data loss. Our advanced encryption methods ensure that recovery is impossible without the correct decryption key. System Integrity: Restoring your PC using a bootable drive or cloud service will be ineffective. Our bootkits are designed to persist on your system. More information on bootkits can be found here: https://en.wikipedia.org/wiki/Bootkit Even if you attempt to reset your PC, the remote access tool (RAT) and rootkit we have installed will enable us to maintain control. For more details on rootkits, visit https://en.wikipedia.org/wiki/Rootkit. Scam Warning: Beware of third-party services that claim they can decrypt your data. Independent research will confirm that decrypting ransomware is infeasible without the correct key. Once we receive your payment, the decryptor will be provided to you immediately. Sincerely, Mesmerised Locker Team
URLs

https://getsession.org

Targets

    • Target

      locker.exe

    • Size

      96KB

    • MD5

      f2968d0ef2c95f2a2dfb8740b6a2df3f

    • SHA1

      57db6387ab42a51e185bbbf7d54bdfef2541b59c

    • SHA256

      25e41d0a73121a4314df3ce977d182739f592d168999cfa6cd0b8eb69c0e6ebe

    • SHA512

      df35537fc5792cfae0c268c0b8ba49afb62a0672cd83bfe2ab899b85079423b1aa14d2a25b0c72f3b884315e35bbb7b53543780f212bdb67b105a2953a667d09

    • SSDEEP

      768:kCq6+Ae2btbSbEdAp5pAFBkmT2flfuFbMg:HT+ADtbSbeupmymT2flfu9Mg

    Score
    10/10
    • Renames multiple (169) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks